> ## Documentation Index
> Fetch the complete documentation index at: https://docs.timetracker.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Task permissions

> Which roles can create, edit, delete, bulk edit and estimate tasks, how project visibility limits what you see, and how per-project overrides work.

Five capabilities govern tasks. This page maps them to the seven roles and explains the two rules people get wrong.

## The task capabilities

| Capability            | What it allows                                                           |
| --------------------- | ------------------------------------------------------------------------ |
| `task.create`         | Create a task or subtask, and duplicate one                              |
| `task.edit`           | Change any task field, comment, attach files, set blockers, set a repeat |
| `task.delete`         | Archive, delete to Trash, restore, delete permanently                    |
| `task.bulkEdit`       | Change or move several tasks in one action                               |
| `task.reviseEstimate` | Set or revise a task's estimate                                          |

Two nearby capabilities matter too:

| Capability      | What it allows                             |
| --------------- | ------------------------------------------ |
| `tag.manage`    | Rename, recolour and delete workspace tags |
| `budget.manage` | Add or remove a task budget cap            |

## Role matrix

| Capability            | Owner | Admin | Project Manager | Finance | Member | Contractor | Client |
| --------------------- | ----- | ----- | --------------- | ------- | ------ | ---------- | ------ |
| `task.create`         | Yes   | Yes   | Yes             | No      | Yes    | Yes        | No     |
| `task.edit`           | Yes   | Yes   | Yes             | No      | Yes    | Yes        | No     |
| `task.delete`         | Yes   | Yes   | Yes             | No      | No     | No         | No     |
| `task.bulkEdit`       | Yes   | Yes   | Yes             | No      | No     | No         | No     |
| `task.reviseEstimate` | Yes   | Yes   | Yes             | No      | No     | No         | No     |
| `tag.manage`          | Yes   | Yes   | Yes             | No      | No     | No         | No     |

The roles are a strict subset chain: `owner ⊇ admin ⊇ project_manager / finance ⊇ member ⊇ contractor ⊇ client`. See [/concepts/roles-and-capabilities](/concepts/roles-and-capabilities).

### Why the lines fall where they do

* **Finance holds none of them.** Finance owns the money surface – invoices, payments, expenses – not delivery. It reads history rather than changing the work.
* **Client holds none of them.** A portal contact sees only what is explicitly shared with their company, and can comment through the portal.
* **Member and Contractor stop short of delete and bulk edit.** Creating work is safe. Removing it, or changing hundreds of rows at once, is not.
* **Estimates are separate from editing.** An estimate is a commitment, and moving it changes what the project is measured against.

## Rule 1: a capability is not a scope

`task.edit` says you **may** edit tasks. It does not say **which** tasks.

Two things narrow that further:

| Gate                  | What it limits                                |
| --------------------- | --------------------------------------------- |
| **Project reach**     | You only see tasks in projects you can reach  |
| **Supervision scope** | Whose work you may look at on shared surfaces |

Being assigned a task is **not** a grant of the project around it. A task in a project outside your visibility does not appear on your board, in your backlog, or on your own Tasks page – there is no side channel onto projects the board hides.

For "whose work", `time.viewOthers` plus your supervision scope decide together. See [/concepts/supervision-scope](/concepts/supervision-scope) and [/projects/project-visibility](/projects/project-visibility).

## Rule 2: hiding a control is not the boundary

Every control you see is a convenience. The server checks the capability again on every write. Two consequences:

* A hidden button means you almost certainly cannot do the thing.
* A visible button is not a promise. If your capability changed since the page loaded, the save is refused and you get a message.

## Per-project overrides

One task capability can be **widened for a single project**: `task.reviseEstimate`.

A workspace can give someone a higher role on one project only. That person then sees the revise-estimate control on that project and nowhere else.

| Rule                | Behaviour                                                    |
| ------------------- | ------------------------------------------------------------ |
| Direction           | Widen only. An override never narrows what you already hold  |
| Reach               | The one project the override names                           |
| Which capabilities  | Only `task.reviseEstimate`                                   |
| Where it is decided | On the server, per project, so the control matches the truth |

An Admin is never narrowed by a lower override on a project.

See [/team/per-person-permissions](/team/per-person-permissions).

## App and plan gating

Two different gates. Do not confuse them.

| Gate                 | Effect when it fails                               |
| -------------------- | -------------------------------------------------- |
| **App switched off** | The whole area is hidden and its URLs stop working |
| **Not on your plan** | The area stays in the sidebar and shows a paywall  |

Tasks belong to the **Projects & tasks** app, which is on by default and part of the **Free** plan. If someone switches it off in workspace settings, the Tasks page and the project task tabs are gone for everyone, and every task write is refused.

Things attached to a task have their own gates:

| Feature                           | App              | Plan |
| --------------------------------- | ---------------- | ---- |
| Task budget cap                   | Budgets          | Pro  |
| Visible to client, Send to client | Client portal    | Pro  |
| Timer and tracked time            | Time tracking    | Free |
| Blockers, subtasks, repeats, tags | Projects & tasks | Free |

Blockers and recurring tasks are deliberately **not** gated on the Planner or Invoices. Switching those off never stops you adding a blocker or setting a repeat.

See [/concepts/apps-and-modules](/concepts/apps-and-modules) and [/concepts/plans-and-features](/concepts/plans-and-features).

## Who can see cost on a task

The **Cost** row in a task's Financials section needs `time.viewCost` or `rate.viewCost`. For everyone else the figure is left out of the data entirely, not hidden with styling.

By default those live with Owner and Admin. Project Manager sets rates and reads billing rates but does not see cost. See [/concepts/rates-explained](/concepts/rates-explained).

## What each role can actually do

<Tabs>
  <Tab title="Owner and Admin">
    Everything on a task: create, edit, delete, bulk edit, estimate, manage tags, add budget caps and see cost. Only Owner can delete the workspace itself.
  </Tab>

  <Tab title="Project Manager">
    Owns delivery. Creates, edits, deletes and bulk edits tasks, revises estimates and curates tags. Sets rates and reads billing rates, but does **not** see cost figures.
  </Tab>

  <Tab title="Finance">
    Holds no task capabilities. Reads the audit trail and owns invoices, payments and expense approval instead.
  </Tab>

  <Tab title="Member">
    Creates and edits tasks, comments, attaches files, sets blockers and repeats, applies and creates tags, tracks time. Cannot delete, bulk edit or revise estimates – unless widened on a specific project.
  </Tab>

  <Tab title="Contractor">
    The same task capabilities as Member. The difference is elsewhere: a Contractor cannot see the client roster or build reports.
  </Tab>

  <Tab title="Client">
    No task capabilities. Sees shared projects and tasks marked **Visible to client** in the portal, and can comment there.
  </Tab>
</Tabs>

## Example

At Northwind Studio:

* **Priya Raman** (Project Manager) creates `WR-142`, sets a 6-hour estimate, and bulk-moves six finished tasks into Done.
* **Sarah Lin** (Member) edits `WR-142`, adds the **Design** tag, comments, attaches a file and tracks 3 hours. She cannot change the estimate, and there is no Delete in her Actions menu.
* Priya then gives Sarah a per-project override on **Website Redesign**. Sarah now sees the revise-estimate control on that project only. On Harbor Logistics – Mobile App, she still does not.
* **Daniel Okafor** (Finance) opens the project to invoice the hours. He cannot edit a task or post a comment.
* **Ruth Castillo** (Client) sees the tasks marked Visible to client, and can reply to Priya in the portal.

## Common questions

<AccordionGroup>
  <Accordion title="Can I let a Member delete tasks?">
    Not through the default roles. Custom roles let a workspace build its own capability bundles – see [/team/custom-roles](/team/custom-roles).
  </Accordion>

  <Accordion title="Can I take a capability away from one person?">
    Yes, for the capabilities the product allows to be denied per person. See [/team/per-person-permissions](/team/per-person-permissions).
  </Accordion>

  <Accordion title="Why can a Member create a tag but not rename one?">
    Minting a tag while you type keeps tagging unblocked. Curating the shared vocabulary is a delivery-tier action, so renaming, recolouring and deleting need `tag.manage`.
  </Accordion>

  <Accordion title="Why can a Contractor edit tasks but not see clients?">
    Contractor is the narrowest staff role. It works the same tasks as a Member, but the client roster and report building are withheld.
  </Accordion>

  <Accordion title="Does an assignment let me see the project?">
    No. Project reach is decided by project visibility, not by assignment. A task in a project you cannot reach does not appear anywhere for you.
  </Accordion>
</AccordionGroup>

## Troubleshooting

<AccordionGroup>
  <Accordion title="Forbidden, or a permission message on save">
    Your role does not hold that capability, or it was changed after the page loaded. Refresh, then check the matrix above.
  </Accordion>

  <Accordion title="I can see the task but not edit it">
    You can reach the project, which is enough to read it, but you do not hold `task.edit`.
  </Accordion>

  <Accordion title="A teammate sees a control I do not">
    Either they hold a higher role, or they have a per-project override on that project. Estimates are the one capability that can be widened this way.
  </Accordion>

  <Accordion title="The whole Tasks area vanished">
    The **Projects & tasks** app was switched off in workspace settings. An Owner or Admin can turn it back on at [/settings/apps](/settings/apps). Nothing was deleted.
  </Accordion>

  <Accordion title="I can see a paywall on a task feature">
    That feature is on the Pro plan – budget caps and the client portal, for example. See [/billing/overview](/billing/overview).
  </Accordion>
</AccordionGroup>

## Related guides

<CardGroup cols={2}>
  <Card title="Roles and capabilities" icon="lock" href="/concepts/roles-and-capabilities">
    The seven roles and all 66 capabilities.
  </Card>

  <Card title="Supervision scope" icon="eye" href="/concepts/supervision-scope">
    Capability says may, scope says whose.
  </Card>

  <Card title="Project visibility" icon="folder" href="/projects/project-visibility">
    What decides project reach.
  </Card>

  <Card title="Apps and modules" icon="toggle-right" href="/concepts/apps-and-modules">
    Switched off versus not on your plan.
  </Card>

  <Card title="Per-person permissions" icon="user-cog" href="/team/per-person-permissions">
    Overrides and denials.
  </Card>

  <Card title="Plans and features" icon="credit-card" href="/concepts/plans-and-features">
    What Free and Pro include.
  </Card>
</CardGroup>